On Sun, Sep 16, 2001 at 08:26:01PM +0430, Mehdi Kianpour wrote:
> I've tested tcpdump and windump on Redhat 7 vs Windows 98. Windump had
> packet loss above 20% when working on a network with 10% utilization but
> tcpdump had no packet loss.
Are you using the "packets dropped by kernel" message from
tcpdump/WinDump as an indication of packet loss?
If so, note that, on 2.0[.x] and 2.2[.x] kernels, there's no way for
libpcap to get information about how many packets were dropped and, even
on systems with a 2.4[.x] kernel, which do provide a way for libpcap to
get that information, not all versions of libpcap do so.
The version that comes with Red Hat 7.x might do so - the
libpcap-0.4-ss991029 version of libpcap from Alexey Kuznetzov will do so
*if* compiled on a system that defines PACKET_STATISTICS in the
<linux/if_packet.h> file, and the versions of libpcap in at least some
versions of Red Hat Linux (starting in 6.1) are based on various of
Alexey's patched versions.
In addition, the current CVS version of tcpdump.org's libpcap will also
use that mechanism if compiled on a system that defined the "struct
tpacket_stats" structure in <linux/if_packet.h>.
So tcpdump won't report any dropped packets on a Linux system unless
1) you're running a 2.4 or later kernel (or have put Alexey's
"turbopacket" patches into a 2.2[.x] kernel; the stuff in
those patches appears to be part of 2.4[.x])
and
2) you're using a version of libpcap that includes support for
the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call (which
means it must be present in the source for the library *and*
the library must have been on a machine that has a Linux
2.4[.x] (or 2.2-plus-"turbopacket") <linux/if_packet.h>
header file.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
